Read the docs
TI-2020-18455 Aliases CVE-2020-36128GHSA-2mmj-hgqm-x284

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing…

Priority LOW 38CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-290.

Summary

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its reseller. By intercepting HTTPS traffic from the application store, it is possible to collect the request responsible for assigning the X-Terminal-Token to the terminal, which makes it possible to craft an X-Terminal-Token pretending to be another device. An attacker can use this behavior to authenticate its own payment terminal in the application store through token impersonation.

Why it matters now

EPSS 0.01158 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:paxtechnology:paxstore:*:*:*:*:*:*:*:*up to 7.0.8_20200511171508VulnerablePAX Technology
  • cpe:2.3:a:paxtechnology:paxstore:*:*:*:*:*:*:*:* Versions up to 7.0.8_20200511171508 Vulnerable ·PAX Technology

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36128
  2. 2026-10-03 Alias added: GHSA-2mmj-hgqm-x284

References

Exploit 1

Other 2

  • TI-2020-18453 Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access… CVSS 3.1HIGH 8.1
  • TI-2020-18452 Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access… CVSS 3.1HIGH 7.1
  • TI-2020-18451 Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External… CVSS 3.1MEDIUM 6.5
  • TI-2020-18454 Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences